Audited 2026-10-25 · Sources: GitHub repo metadata + README + legal docs tree, watcher security scan, HN/X/press activity reported in our digest. Tabletop audit — nothing downloaded, installed, or executed.
The card
| Repo | oosexgang/hackios-xnu-kernel (the project calls itself HakiOS) |
| Stars | ~1.5k (GitHub, audit date) — public since 2026-10-22, steady growth rather than a spike. Its Hacker News thread cleared 340 points; Decrypt and Android Authority covered the wider iOS-on-Android trend. |
| License | Mixed — GitHub flags it NOASSERTION. The author's own code sits under the license of the files it touches: the XNU kernel patch under Apple's APSL 2.0, the rest per file headers. Unusually, the repo ships LEGAL.md, COMPLIANCE.md, THIRD_PARTY_LICENSES.md, and a NOTICE file. |
| Provenance | Small research team (oosexgang), brand-new org with no track record. Commenters on the HN thread say much of it was written with AI — unverified either way. |
| What it is | A custom XNU build (patched xnu-8796.121.2 plus original drivers), a custom UEFI boot loader, and an original userland — claimed to boot the stock iOS 16.5 user space on a POCO X5 Pro (Snapdragon 778G) via fastboot boot, entirely in RAM. Nothing is flashed; a reboot returns the phone to Android. A QEMU path runs the same stack on a Linux PC. |
| Install surface | Heavy: an unlocked-bootloader phone or QEMU, a script that pulls the ~7.4 GB iOS 16.5 IPSW from Apple's public servers, firmware pulled off your own phone, and a prebuilt/ directory shipping a compiled kernel, loader, and libraries. |
What problem it solves
It doesn't solve a problem you have — it's a research bench answering "can the iOS user space run on Android silicon?" The claim: lock screen, SpringBoard, gestures, stock apps, touch, GPU rendering through Mesa, Wi-Fi, cameras, speakers — with cellular data, Bluetooth, charging, and Metal still on the not-yet side. The claim is the team's own README; nobody independent has reproduced it.
Our gate findings
| Gate | Finding |
|---|---|
| Upstream identity | Thin — new org, no history; the work itself is the only artifact. The headline claim is self-published and unverified by us. |
| License / legal | The most thoroughly documented posture we've audited: per-file license tracking, a COMPLIANCE.md walking the APSL 2.0 obligations, and a standing offer to remove anything infringing. Also true: a script downloads Apple's iOS firmware image. Their argument — public servers, no decryption, no circumvention — is a position, not a ruling. Not legal advice; Apple's counsel gets a vote. |
| The funding flag | Watchers report a $HACKIOS crypto token attached to the project off-repo. That incentive shape rewards viral claims over verified ones — discount the README's confidence accordingly. |
| Prebuilt binaries | The one thing our scanner actually flagged: prebuilt/ ships a compiled kernel, loader, and libraries. Virus scan came back clean — but "clean today" is not a chain of custody, and running someone's ring-0 kernel on a phone is the deepest trust grant on this list. |
| Claims discipline | Credit where due: the Works/Not-yet table is unusually candid — the modem sees the network but data sessions are in progress, no Bluetooth, no charging under this kernel, no Metal, no Apple account possible. The framing is honest: a session in RAM, not a ROM. |
| Security scan | WARN — the prebuilt binaries were the only substantive flag; virus scan clean; nothing executed on our side. |
Verdict: NO-GO to download or run — GO to read. The legal-docs set and the per-driver status table are legitimately educational; the prebuilt kernel, firmware-fetching scripts, crypto funding, and Apple exposure are not worth the curiosity tax on real hardware.
Best for
Security researchers and mobile-OS nerds who read kernel patches for fun. For everyone else it's a spectator sport — and the funding structure means even the spectating should discount the hype.